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with a prepubescent female. Later in the video, the prepubescent female is show 
masturbating and using a vibrator. The adult female and prepubescent female engage in 
oral sex, along with other sex acts. 

67. The partial downloaded version I obtained directly from IP address 24.148.156.21 1 matches 
portions of what was described above and is playable and viewable and the viewable portion 
contains child pornography even though it is a portion of the entire file. 

68. The second file name is (Pthc) Russia lOYo-llYo little Brother And Sister-2 - Boy&Girls Fucking_ 
Just Posing Or Naked l.avi this video shows two preteen boys on a bed who get nude and 
have sex in various positions with a young teen girl. Other clips show nude children 
playing in the sand and in various sexual positions on a bed. The partial downloaded version 
I obtained directly from IP address 24. 148. 1 56.21 1 matches portions of what was described above 
and is playable and viewable. 

69. The UIS was also able to identify the software in use by that IP address as eMule v0.5 and also a 
Globally Unique Identification number associated with the computer using his IP address. The 
GUID associated with this address at the time of the download was 

8348EFA7A3QEF645C3D806F648766F26 . A GUID is assigned to the computer when a file 
sharing program (such as E-Mule or any other peer-to-peer file sharing platform) is placed onto 
the computer. This series of numbers and letters is a unique serial number generated for each 
computer running P2P software around the world. Should the computer be used to access the 
Internet from a different IP address the GUID will remain the same as it is intrinsic to the 
computer system in almost all software programs. Further, should the user of the computer 
update the file sharing program with a newer version, a new GUID will be assigned to the 
computer for the updated program, 

70. Your affiant determined, by using Internet websites that the IP address 24. 148. 1 56.2 1 1 w'here 
child pornography was downloaded from, on the dates listed above was owned by Earth Link as 
the Internet Service Provider (ISP). On August 7, 2012 I contacted SB1 Agent Gerald Thomas 
who forwarded my request for an administrative subpoena to Cheryl King of the NCSBI. Ms. 
King filed and administrative subpoena for the IP address 24.148.156.21 1 for the subscriber 
information on July 21, 2012 at 0400 GTC. Records below indicate 24.148.156.21 was assigned 
to the following Earth Link customer for the time request. The following information was 
returned by Earth Link on August 8, 201 1: 

Subscriber Marne: Roberta Hill 

Service Address: 4 1 3 N 2 nd AVE 

Telephone#: 336-510-7972 

User Name: ms21842365@earthlink.net 

7 1 . Time Warner’s information described the IP address as issued to the above subscriber from 
03/13/2009 to the date of the return of service. 
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72. In verification of the occupants of 413 N 2 nd Ave. Your affiant obtained the NC 
Department of Motor Vehicles Driver License information for Roberta Hill NC OL# 
8867196 that information listed her current address as 413 N 2 nd Ave.. It listed her 
as having a Pontiac Sunfire registered at that address license number PWA6942. 
Brian David Hill is also listed with the NC Department of Motor Vehicles at this 
address with a NC OL# 38360908. 

73. Based on the foregoing identification by IP address 24.148.156.211 a computer at the location 
of the IP addresses and physical address listed in this affidavit (24.148.156.21 1) offered for 
distribution files with ED2K values that are known or suspected to contain child pornography and 
sent to your affiant files containing child pornography. A reasonable officer with the proper 
training and experience could infer and conclude from the logs that the computer at the reported 
IP addresses recently offered for distribution files with digital signatures of known or suspected 
child pornography. It could also be inferred with a high degree of certainty, on your affiant’s 
part, that the (Digital Signatures-or hash values) and IP addresses logged were sharing or offering 
to share those files on the eDonkey Network to other users. Therefore there is probable cause 
to believe that there is evidence (child pornography files and computer trace evidence listed 
in this warrant) of a continual pattern in July of 2012 on-going possession and distribution 
of child pornography through the P2P network (second degree sexual exploitation of a 
minor) (G.S. 14-190.17) located on the premises of 413 N 2 nd Ave, Mayodan NC, the Home of 
Roberta Hill W/F DOB: 05/14/1967 NC OLN: 8867196 and Brian David Hill W/M DOB: 
5/26/1990 NC OLN: 38360908, and/or any other person at the residence of at 413 N 2 nd 
Ave Mayodan NC to include any vehicles located at that address: specifically registered to 
Roberta Hill W/F DOB: 05/14/1967 NC OLN: 8867196 that are associated with the home: a 
200 Pontiac Sunfire Plate # PWA6942. 

74. In your affiant's training and experience with computers your affiant has found that many 
individuals store their computers (laptops) inside vehicles at the residence and failure to 
check the vehicles may have result in not finding the computer at the residence. In your 
affiant's training and experience the lease of the IP address is not always the one who used 
the computer on the network and frequently others in homes where an IP address is 
assigned can just as well be the perpetrator. As a result it is imperative to search for all 
computers in the home and or vehicles in order to determine who actually offered child 
pornography and distributed child pornography to me. It is highly probable in your affiant's 
training and experience with this network that a household member of the account 
identified by Earth Link is active in possession and sharing known or suspected child 
pornography on the P2P network. A search of that residence where the Cable Internet 
subscription come back to and the computers and routers at that residence will reveal who 
at that residence has been involved in active participation in the distribution, possession, 
receipt, and sharing of child pornography files. 
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Detective Robert W. Bridge 
Reidsville Police Department 
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